Steer Copilot's automated PR review at the risk that actually keeps you up at night

COPILOT REVIEW FOCUS

WHAT THIS PR ACTUALLY DOES
Adds a bulk-delete endpoint for admin users to remove multiple flagged comments at once.

REVIEW THESE, IN THIS ORDER, WITH THE MOST SCRUTINY
1. Whether the bulk-delete endpoint checks that every comment ID belongs to the requesting admin's organization before deleting. 2. Whether the delete is wrapped in a transaction. 3. Rate limiting on the new endpoint.

DECISIONS ALREADY MADE DELIBERATELY — DO NOT RE-RAISE THESE UNLESS YOU DISAGREE WITH THE REASONING
We chose a hard delete over a soft-delete flag for this table, per the retention policy discussion in #482 — this was intentional.

HOW DEEP TO GO ON THE TOP ITEM
Go deep on item 1 specifically — trace the authorization check through every helper it calls, not just the top-level handler.

Flag anything else in the diff too — an automated review that only ever looks where it was told to
look eventually misses something a human reviewer would have caught by accident while reading in
file order — but lead with the areas listed above and make sure every one of them gets an explicit
answer, not just a comment if something happened to stand out.

For each item in 1. Whether the bulk-delete endpoint checks that every comment ID belongs to the requesting admin's organization before deleting. 2. Whether the delete is wrapped in a transaction. 3. Rate limiting on the new endpoint., answer explicitly: does the diff actually handle this correctly,
and if you are not certain, say so rather than defaulting to a comment only when something looks
clearly wrong — an item you checked and found fine is worth a stated 'checked, looks correct,'
because a reviewer reading this later needs to know the difference between reviewed and clean and
not actually looked at closely.

If a comment applies to a line only because of a broader pattern repeated across several places in
this diff, say so once, name the pattern, and list every location it appears — do not leave a
separate near-duplicate comment on each individual line the pattern shows up on; five copies of the
same observation train a reader to skim past all five rather than absorb any of them.

CONSTRAINTS
- Do not restate We chose a hard delete over a soft-delete flag for this table, per the retention policy discussion in #482 — this was intentional. as a finding needing a decision — if you genuinely believe the
  reasoning behind one of them was wrong, say that explicitly and why, rather than raising it as a
  generic concern that reads as if the tradeoff had never been considered at all.
- If 1. Whether the bulk-delete endpoint checks that every comment ID belongs to the requesting admin's organization before deleting. 2. Whether the delete is wrapped in a transaction. 3. Rate limiting on the new endpoint. asks about something the diff does not actually touch — for example a
  transaction-safety concern on a code path this PR does not modify — say so plainly rather than
  reviewing the unrelated existing code as if it were part of this change.
- Rank your findings by actual severity, not by the order 1. Whether the bulk-delete endpoint checks that every comment ID belongs to the requesting admin's organization before deleting. 2. Whether the delete is wrapped in a transaction. 3. Rate limiting on the new endpoint. listed them in — the order
  in 1. Whether the bulk-delete endpoint checks that every comment ID belongs to the requesting admin's organization before deleting. 2. Whether the delete is wrapped in a transaction. 3. Rate limiting on the new endpoint. reflects what the author was worried about going in, which is not guaranteed to
  match what turned out to be the most serious issue once the diff was actually reviewed.